Privacy Policy

Last updated: May 23, 2026.

TL;DR: we keep your chat history so the bot can use context across sessions; we only share your prompts with the AI model you've selected; we never sell or advertise against your data. You can wipe everything by sending /forget_all inside the bot.

1. Who we are

UltraGPT (the "Service", "we", "us") is an independent AI productivity assistant for Telegram. This Privacy Policy explains what personal data we collect when you use the Service and what we do with it. For any privacy question, reach the data controller at support@ultragpt.ai.

2. What we collect

Account data (from Telegram)

Your Telegram user ID, username, first name, and preferred language — provided by Telegram when you start the bot.
Your referral code (if you came in via someone's link) and our internally-generated referral code for you.

Usage data

Chat history with the bot, including the text of your prompts and the AI's responses, so the assistant can maintain context across sessions.
Captions and metadata of images, voice notes, and documents you send to the bot — needed to invoke the matching AI feature.
A short rolling summary of your preferences that the bot generates automatically (e.g. "user prefers concise answers"). You can wipe this with /forget_all.
Aggregate counters: messages sent, features used, free quota consumed, balance.

Payment data

The amount, currency, status, and timestamp of each payment, plus an opaque external ID from the payment provider.
We do NOT store full card numbers, expiry dates, CVVs, or banking credentials. Card data is handled directly by Stripe under their PCI-DSS-compliant infrastructure.

We do NOT collect

Your Telegram phone number, contacts, geolocation, or any data from chats other than the conversation with our bot.
Browser cookies, tracking pixels, or third-party analytics on the website (this static site uses no analytics SDKs).

3. How we use your data

Operate the Service. Relay your prompts to the AI provider you've selected; store responses so you can scroll history; track your balance and free-quota usage.
Improve the Service. Aggregate usage statistics (no individual identification) to find which features are most useful.
Customer support. When you contact support@ultragpt.ai, we may look up your account and recent activity to help you.
Fraud and abuse prevention. Detect bulk-abuse patterns (e.g. ring-of-accounts trying to drain free credits) and block them.
Legal compliance. Comply with valid legal orders and tax-reporting obligations.

4. Who we share data with

AI model providers — when you send a prompt to GPT-5, Claude, Gemini, etc., the content of that prompt is transmitted to the corresponding provider so it can generate a response. Each provider has its own privacy policy; in particular, business-tier API traffic to OpenAI, Anthropic, and Google is by default not used to train their public models. We use API tiers that exclude training, where the provider offers such an option.
Payment processors — Stripe, Telegram Stars, and Cryptomus receive only what they need to process the transaction.
Hosting providers — our backend runs on infrastructure providers under standard data-processing agreements.
Law enforcement — we comply with valid legal requests but resist over-broad ones to the extent legally possible.

We do NOT sell your personal data. We do NOT use it for cross-platform advertising.

5. International transfers

Your data may be transferred to and processed in countries other than your country of residence (notably the United States, where most AI providers are based). We rely on standard contractual clauses where required.

6. How long we keep your data

Account data: while your account is active, plus 30 days after deletion.
Chat history: until you wipe it with /forget_all or close the account.
Payment records: kept for the legally-required period (typically 5-7 years for tax/AML).
Aggregate analytics: no time limit, but stripped of personal identifiers.

7. Your rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Erase your data (use /forget_all in the bot, or email us).
Object to processing for fraud-prevention purposes (limited — we may need to retain minimal data to block abuse).
Export your data in a portable format (email us at support@ultragpt.ai).
Lodge a complaint with your local data-protection authority.

8. Children

The Service is not intended for users under 13. We do not knowingly collect personal data from children under 13. If you believe a minor has provided us with personal data, email us and we will delete it.

9. Security

We use industry-standard technical and organisational measures: encrypted transport (TLS) for all traffic, encrypted database storage for sensitive fields, restricted access for the small operations team, and a webhook- signature check on all incoming payment notifications. No system is fully breach-proof; we will notify affected users without undue delay if a data incident occurs that impacts their personal data.

10. Changes to this policy

Material changes to this Privacy Policy will be announced in-bot at least 7 days before they take effect, along with a brief summary of what changed.

11. Contact

For any privacy question or to exercise your rights, email support@ultragpt.ai. We respond within 7 business days.